Behavioral task
behavioral1
Sample
fdd5f98d1bad3249349ba3c017487b005613c1b37b21c4b99e688a311fa81b9a.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fdd5f98d1bad3249349ba3c017487b005613c1b37b21c4b99e688a311fa81b9a.dll
Resource
win10v2004-20221111-en
General
-
Target
fdd5f98d1bad3249349ba3c017487b005613c1b37b21c4b99e688a311fa81b9a
-
Size
147KB
-
MD5
14cb6d49866a92e26793f2fce3ef51b6
-
SHA1
8b7be195b9421e61a5cf7a80b5f257aa3e6e4e4b
-
SHA256
fdd5f98d1bad3249349ba3c017487b005613c1b37b21c4b99e688a311fa81b9a
-
SHA512
742b2da179e653ca4af5b150d6618ce47c790fcf45844a74d75b77bdeae7d0bdf6d988c999e042921414f395b32ef3bf8ddba7f25541196b282a2a3a092903b6
-
SSDEEP
3072:roorFi4iXOKg7tGOtWm16sHaaF4urz8LyimJq8x/vklJZxR:DrWXfCtGOtj6sHRNieq8xg
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
fdd5f98d1bad3249349ba3c017487b005613c1b37b21c4b99e688a311fa81b9a.dll windows x86
5d86e9cb92ad9514707dfa585da4a975
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
DeleteCriticalSection
LoadLibraryA
VirtualProtect
user32
GetKeyboardType
advapi32
RegQueryValueExA
Sections
CODE Size: - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 5KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp2 Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ